GitHub Advisoryadvisory · Go

GHSA-m45g-f45x-vv22 Improper input validation in CNCF Cortex

MEDIUM Published 2021-06-23 Modified 2021-05-20 Official page ↗
Aliases
CVE-2021-31232
Ecosystem
Go
Packages
github.com/cortexproject/cortex
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20
Reviewed
2021-05-20

Affected packages

• Go github.com/cortexproject/cortex: < 1.8.1 → fixed in 1.8.1

Description

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.

Related

Alias · CVE (1)

  • CVE-2021-31232 The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References